File bnc629447_CVE-2010-2806.diff of Package freetype2

Overview Repositories Revisions Requests Users Attributes Meta

File bnc629447_CVE-2010-2806.diff of Package freetype2

From c06da1ad34663da7b6fc39b030dc3ae185b96557 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Thu, 05 Aug 2010 21:15:26 +0000
Subject: Fix Savannah bug #30656.

* src/type42/t42parse.c (t42_parse_sfnts): Protect against negative
string_size.
Fix comparison.
---
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index 4dc7203..5774269 100644
--- freetype-2.3.7/src/type42/t42parse.c.orig	2008-05-29 00:12:11.000000000 +0200
+++ freetype-2.3.7/src/type42/t42parse.c	2010-08-10 19:17:08.058395443 +0200
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 42 font parser (body).                                          */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008 by Roberto Alameda. */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2010 by Roberto Alameda. */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
@@ -568,6 +568,12 @@
         }
 
         string_size = T1_ToInt( parser );
+        if ( string_size < 0 )
+        {
+          FT_ERROR(( "t42_parse_sfnts: invalid string size\n" ));
+          error = T42_Err_Invalid_File_Format;
+          goto Fail;
+        }
 
         T1_Skip_PS_Token( parser );             /* `RD' */
         if ( parser->root.error )
@@ -575,13 +581,14 @@
 
         string_buf = parser->root.cursor + 1;   /* one space after `RD' */
 
-        parser->root.cursor += string_size + 1;
-        if ( parser->root.cursor >= limit )
+	if ( limit - parser->root.cursor < string_size )
         {
           FT_ERROR(( "t42_parse_sfnts: too many binary data!\n" ));
           error = T42_Err_Invalid_File_Format;
           goto Fail;
         }
+	else
+ 	  parser->root.cursor += string_size + 1;
       }
 
       if ( !string_buf )

Places

File bnc629447_CVE-2010-2806.diff of Package freetype2

Places